Skip to main content
Apexward Pulse

Barracuda Networks · Auth bypass

Barracuda Networks Multiple Products OS Command Injection Vulnerability

CVE-2026-111560

What this means

This is rated high severity (8.6 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Barracuda Networks Multiple Products is in your estate, and treat that as the priority.

Full vendor description

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Scoring and exploitation

8.6/ 10
CVSS 4.0 base scoreHigh

Exploitable over the network with an administrator-level account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredHighPR:H
User interactionNoneUI:N

Impact

Longer bar: more harm

ConfidentialityHighVC:H
IntegrityHighVI:H
AvailabilityHighVA:H
~1.1% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Barracuda Networks Multiple Products

Weaknesses

CWE-78

References

3 links from the CVE record, grouped by site.

Related feed events